Kouxian Digital Rhythm (扣舷-数字节律)

The only account with access to sensitive repository resources is the maintainer, whose GitHub account has two-factor authentication enabled. The collaborator list contains no other users.

Collaborators are added only through an individual invitation by the repository owner. This personal-account repository offers only owner/collaborator roles; collaborator access is the lowest available role. The current access list contains only the owner. See https://docs.github.com/en/enterprise-cloud@latest/repositories/managing-your-repositorys-settings-and-features/repository-access-and-collaboration/permission-levels-for-a-personal-account-repository.

GitHub branch protection on main requires a pull request and the successful windows-python check, applies to administrators, and blocks force pushes. Direct pushes are prevented.

GitHub main-branch protection has allow_deletions=false. Deletion of the primary branch is blocked.

The CI workflow does not interpolate untrusted event metadata into shell commands. Its steps run fixed commands, and workflow_dispatch defines no user-controlled inputs. See https://github.com/Ansel-Poiesis/interaction-rhythm-source/blob/main/.github/workflows/ci.yml.

The workflow grants only contents:read, contains no repository-secret references, and no repository secrets are configured. Pull-request jobs therefore have no repository write token or privileged project secrets.

Official project and source-repository URLs use HTTPS. The http:// URLs in source code are limited to loopback application endpoints; the OFL URL is an upstream license reference, not a project channel.

The only current public software distribution channel is the GitHub source repository and its source archives, delivered over HTTPS. No installer binaries are distributed; the previous v0.11.3, v0.11.6, and v0.11.8 EXE/ZIP assets were withdrawn.

GitHub secret scanning and push protection are enabled. The clean public tree excludes local databases, settings, logs, temporary data, certificates, and build output. Pre-release source review found no credential files.

docs/user-guide.md covers startup, tray behavior, dashboard and heatmap, export, optional AI and email, backup, privacy controls, and exit.

docs/bug-reporting.md and the public bug issue template explain how to report defects while excluding databases, logs, exports, screenshots, email addresses, and credentials.

Public GitHub Issues support usage-obstacle discussion and pull requests support proposed changes: https://github.com/Ansel-Poiesis/interaction-rhythm-source/issues.

CONTRIBUTING.md explains the pull-request process, required checks, use of synthetic fixtures, exclusion of personal data, and disclosure of third-party material sources and licenses.

The public source code is licensed under the OSI-approved MIT License in the repository root.

Current public software releases contain MIT-licensed source only and no installer binaries. The legacy release repository has had its v0.11.3, v0.11.6, and v0.11.8 EXE/ZIP assets withdrawn and is documented as a historical record outside the current project distribution scope.

The root LICENSE file maintains the MIT license for the source code.

The v0.1.0 source tag includes the root MIT LICENSE file; GitHub source archives are generated from that licensed tree. No application binary is attached to the release.

The source repository is publicly readable at the static URL https://github.com/Ansel-Poiesis/interaction-rhythm-source.

The public Git history records the clean root snapshot and the later documentation change, including authors and timestamps; the private development history was not imported.

Direct Python dependencies are listed in requirements.txt and requirements-dev.txt. JavaScript and PowerShell checks use runtime tools and introduce no additional package dependencies.

docs/project-scope.md identifies interaction-rhythm-source as the sole current public codebase and documents the private development repository and legacy distribution repository as outside that codebase.

The tracked public source tree contains no generated executables, installers, archives, shared libraries, or bytecode caches; git ls-files extension review returned zero matches.

Tracked binary files are reviewable product-content assets: PNG icons and OFL-licensed WOFF2 fonts with upstream notices. The repository contains no executable application binaries or compiled library files.

SECURITY.md identifies the repository maintainer as the security contact through GitHub's private vulnerability reporting form and tells reporters not to post exploitable details publicly.